Merge branch 'deserialize-authorities' into 'master'

fix: provide factory method for jackson to deserialize authorities

`@JsonProperty` won't work with the abstract `? extends GrantedAuthority` type, as Jackson doesn't have a constructor or factory to convert a string into a concrete implementation.

This change adds a factory method which takes a Collection<String> (which Jackson can understand) and uses Spring Security's utility method to convert the Collection of Strings to a Collection of GrantedAuthority instances.

Note: the 'Amy Administrator' user provided by the 'local-users.json|yaml' file is no longer strictly equivalent to those provided in 'local-users.properties'. See adi-ia/uw-spring-security#5; correcting that seems to be outside of the scope of a bugfix, as it will result in something that likely requires a new feature release.

cc: @bjsousa @paul.erickson @lyle @apatwary @SPYANG4 @bhill6 

See merge request !21